Angerona/documentation-payload/Cazalla/_index.md

+++ title = "Cazalla" chapter = true weight = 100 +++

Cazalla is a lightweight Windows implant written in C, designed for the Mythic C2 Framework.

Overview

Cazalla provides essential post-exploitation capabilities including:

• File System Operations - Navigate, read, write, and manage files
• Process Management - Enumerate, terminate, and interact with processes
• Token Manipulation - Steal and impersonate security tokens
• Network Tunneling - SOCKS5 proxy and reverse port forwarding
• Credential Harvesting - Automatic credential detection from files
• Keylogging - Low-level keyboard input capture
• Full Mythic Integration - Process Browser, File Browser, OPSEC checking

Command Categories

File System (9 commands)

• ls - List directory contents
• cd - Change directory
• pwd - Print working directory
• cat - Read file contents
• cp - Copy files
• mkdir - Create directory
• rm - Delete file/directory
• download - Download file from target
• upload - Upload file to target

Process Management (2 commands)

• ps - List processes
• kill - Terminate process

Token Operations (5 commands)

• list_tokens - Enumerate tokens
• steal_token - Steal process token
• make_token - Create token from credentials
• rev2self - Revert to original token
• whoami - Display current context

Network Tunneling (2 commands)

• socks - Start/stop SOCKS5 proxy
• rpfwd - Start/stop reverse port forwarding

System Operations (4 commands)

• shell - Execute shell commands
• screenshot - Capture desktop screenshot
• keylog_start - Start keylogger
• keylog_stop - Stop keylogger

Control (2 commands)

• sleep - Adjust beacon interval
• exit - Terminate agent

Key Features

Process Browser Integration

Cazalla automatically updates Mythic's Process Browser, allowing you to interact with processes directly from the UI.

File Browser Integration

Seamlessly browse the target's file system through Mythic's File Browser.

OPSEC Checking

Built-in operational security checking warns operators before executing risky commands.

Context Tracking

Automatic tracking and display of current working directory and active token impersonation.

Installation

See the [Getting Started Guide] for installation and setup instructions.

Documentation

• Commands Reference - Complete documentation of all commands
• Getting Started - Installation and first steps
• Features Overview - Detailed feature explanations
• OPSEC Guide - Operational security considerations
• Usage Examples - Practical examples and use cases
• Troubleshooting - Common issues and solutions

---

Developed by: Kaseya OFSTeam